Ethereum

Lido DAO

Request

ERC20

<div class="sg-post-des">
 The “fake deposit” attack enables bad actors to execute a transfer where the requested value is larger than what the user actually owns. 
</div> 
<div class="cointelegraph"> 
 Ethereum staking protocol Lido Finance has assured both Lido DAO (LDO) and staked-Ether (stETH) tokens remain safe despite hackers allegedly exploiting a known security flaw in LDO’s token contract. 
 Lido didn’t confirm any exploits, but acknowledged the security flaw was known and reassured LDO and stETH funds remain safe in response to a Sept. 10 post by blockchain security firm SlowMist. 
 SlowMist said LDO’s flawed <a rel="noopener noreferrer nofollow" title="token" href="https://thebittimes.com/tag/token.html">token</a> <a rel="noopener noreferrer nofollow" title="contract" href="https://thebittimes.com/tag/contract.html">contract</a> allows bad actors to facilitate “fake deposit” attacks on exchanges because LDO’s <a rel="noopener noreferrer nofollow" title="token" href="https://thebittimes.com/tag/token.html">token</a> <a rel="noopener noreferrer nofollow" title="contract" href="https://thebittimes.com/tag/contract.html">contract</a> enables users to execute transactions even where they don’t have sufficient funds. This code deviates from the Ethereum Request for Comment 20 (ERC-20) <a rel="noopener noreferrer nofollow" title="token" href="https://thebittimes.com/tag/token.html">token</a> standard, according to SlowMist. 
 However, Lido Finance argued the flaw is built into all ERC-20 tokens — not just Lido’s LDO token: 
 <blockquote class="twitter-tweet"> 
 This behaviour is expected and conforms to the ERC20 <a rel="noopener noreferrer nofollow" title="token" href="https://thebittimes.com/tag/token.html">token</a> standard (see tweet below). Both LDO and stETH (and Lido governance) <a rel="noopener noreferrer nofollow" title="remain" href="https://thebittimes.com/tag/remain.html">remain</a> safe. Lido <a rel="noopener noreferrer nofollow" title="token" href="https://thebittimes.com/tag/token.html">token</a> integration guides will be updated with LDO specifics to make this more visible shortly.— Lido (@LidoFinance) September 10, 2023 
 </blockquote> 
 SlowMist said the “fake deposit” attacks came from LDO’s token contract executing transfers where the value is larger than what the user actually owns, triggering a false return as opposed to reverting the transaction. While the firm said Lido's token contract has recently been exploited via this attack, no on-chain evidence was provided. 
 Cointelegraph reached out to SlowMist for comment but did not receive an immediate response. 
 Meanwhile, on-chain analyst “Hercules” explained on Sept. 10 that the security flaw may not be picked up by cryptocurrency exchanges. 
 SlowMist recommends LDO holders to also check the return values of the <a rel="noopener noreferrer nofollow" title="token" href="https://thebittimes.com/tag/token.html">token</a> <a rel="noopener noreferrer nofollow" title="contract" href="https://thebittimes.com/tag/contract.html">contract</a> transfers in addition to the success or failure of a transaction. 
 The blockchain security firm concluded that token contract implementations and behaviors vary by project and to conduct comprehensive testing before integrating any new tokens. 
 Related: Ethereum staking services agree to 22% limit of all validators 
 However, Lido highlighted in the official Ethereum Improvement Proposal document — co-authored by Vitalik Buterin in November 2015 — that both the “transfer” and “transferFrom” functions must return the transfer status and are only recommended to revert a transaction in exceptional cases. 
 <blockquote class="twitter-tweet"> 
 ERC20 token standard: https://t.co/YlrS1ZN6Fd 1) Both transfer and transferFrom are required to return transfer status and are only recommended to revert a tx in exceptional cases. 2) The standard says that a caller is obliged to check the return status (see 'Token methods'). pic.twitter.com/6KTcIyxo2F— Lido (@LidoFinance) September 10, 2023 
 </blockquote> 
 To resolve the security flaw, Lido confirmed the LDO token integration guides will soon be updated. 
 Magazine: DeFi Dad, Hall of Flame: Ethereum is ‘woefully undervalued’ but growing more powerful 
 <template data-name="subscription_form" data-type="crypto_biz"></template> 
</div> 
Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/lido-assures-ldo-steth-tokens-remain-safe-despite-flaw-in-token-contract-tbt62217.html">https://thebittimes.com/lido-assures-ldo-steth-tokens-remain-safe-despite-flaw-in-token-contract-tbt62217.html</a>

Lido assures LDO, stETH tokens remain safe despite flaw in token contract

TheBitTimes

Other articles published on Sep 11, 2023

Arbitrum's fraud proofs haven't been used in the two years since it launched

Ethereum Falls As bears Try To Break $1,600 Support Level

Elon Musk's Twitter Targeted: Beware of the $25 Million Crypto Scam

India's Central Bank Explores New Features to Boost Digital Rupee Adoption

Shiba Inu (SHIB) Crucial Metric Goes up Despite Price Plummeting

India working on 5-point crypto legislation as ban is ruled out

Join our free newsletter for daily crypto updates!